Breaches of the Contract Procedure Rules 2017/18

City of York Council

Internal Audit Report

Business Unit: Customer and Corporate Services Directorate, Responsible Officer: Director of Customer & Corporate Services Service Manager: Corporate Finance & Commercial Procurement Manager Date Issued: 1st May 2018 Status: Final Reference: 19080/031

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | High Assurance | Summary and Overall Conclusions

Introduction The Contract Procedure Rules (CPRs) outline the responsibilities and actions that Officers and Directors must follow whilst undertaking procurement and contract arrangements. They aim to ensure value for money whilst promoting integrity, transparency, and fairness. They also aim to ensure compliance with legal requirements, as well as the Council's constitution and strategic objectives. Therefore, a breach of the CPRs indicates that there has been expenditure that does not comply with the agreed standards of the council, the nature of which can be varied.

For 2016/17, there were a 19 individual breaches identified, with a total value of approximately £10.8m. This represents a significant rise from 2015/16, where there were 13 breaches with a value of £749k. Between April and September 2017, there have been 8 individual breaches identified, with a total value of £140k.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that breaches of the Contract Procedure Rules are:

- adequately directed by formal policy;
- monitored and reported in a constructive and substantive way;
- identified effectively.

This audit did not focus on the specific instances of individual breaches, and looked primarily at the corporate arrangements relating to breaches of the CPRs.

Key Findings The procedures for identifying, monitoring and reporting breaches were found to be working well. The policy guidance within the Council's Contract Procedure Rules covering breaches was brief but it did cover the necessary procedures that should be followed if breaches to the Contract Procedure Rules had occurred. The process for reporting breaches was found to be working well in that breaches were recorded in a consistent manner on the breaches register and reported to the Governance, Risk & Assurance Group on a regular basis. The only issue noted was that it would be useful to record the financial regulation that has been broken in the breaches register because this would make it easy to identify trends in breaches across the council.

Although it is difficult to identify breaches that have not been reported, the Commercial Procurement Team produced purchase order reports on a monthly basis to identify purchases where there might have been a breaches of the Contract Procedure Rules. These reports contain details of outstanding queries that need to be resolved so that breaches can be reported to the Governance, Risk & Assurance Group. New suppliers can only be set up by staff in the Commercial Procurement to monitor the use of new suppliers.

Best practice was also sought from other Local Authorities as to how breaches to financial regulations are identified. The responses varied in terms of the methods that other councils used to identify breaches. The comments will be passed on to the Commercial Procurement Team so that they can compare their working practices with other authorities.

**Overall Conclusions**

It was found that the arrangements for managing risk were very good. An effective control environment appears to be in operation. Our overall opinion of the controls within the system at the time of the audit was that they provided High Assurance.

1. Recording the breach type in the breaches register

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The financial regulation that has been breached is not recorded in the breaches register. | Inadequate information being recorded could prevent effective analysis and understanding of the breaches that are occurring. |

**Findings**

There is sufficient detail recorded of the breach type to allow adequate understanding of individual breaches. However, there is no column on the breaches register to record which financial regulation had been broken.

Listing which financial regulation had been broken could enable more effective and efficient analysis of breaches as a whole, as it would be an extra insight into analysing the data. This could allow trends to be more easily identified.

**Agreed Action 1.1**

A column will be added to the breaches register as suggested

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Corporate Finance & Commercial Procurement Manager | Completed | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.